common: OpTracker doesn't visit TrackedOp when nref == 0.

The patch fixes a race condition that happens between
`unregister_inflight_op` and `visit_ops_in_flight` of
`OpTracker`. When a callable passed to the former one
turns the plain reference it gets into `TrackedOpRef`,
an almost-to-terminate `TrackedOp` (with `nref == 0`)
can be resurrected (`nref++`). This will be reflected
in extra call to `unregister_inflight_op` for same op
leading to e.g. use-after-free. For more details see:
https://tracker.ceph.com/issues/24037#note-5.

The fix deals with the problem by ensuring there will
be no call to the visitor for ops with zeroized `nref`.

Fixes: http://tracker.ceph.com/issues/24037
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
(cherry picked from commit 574aeb8130926fab5632d9f7a6ac0b132c6a60b8)

diff --git a/src/common/TrackedOp.cc b/src/common/TrackedOp.cc
index feb3e9f7308324c4181c63d95c31866d9d1750ce..8d4e986190aa22ee42afcbb8bb9994908109b650 100644 (file)
--- a/src/common/TrackedOp.cc
+++ b/src/common/TrackedOp.cc
@@ -328,7 +328,7 @@ bool OpTracker::visit_ops_in_flight(utime_t* oldest_secs,
     assert(NULL != sdata);
     Mutex::Locker locker(sdata->ops_in_flight_lock_sharded);
     for (auto& op : sdata->ops_in_flight_sharded) {
-      if (!visit(op))
+      if (op.nref > 0 && !visit(op))
        break;
     }
   }